PHP2Shell Exploits Target PHP Memory Flaws and PAN-OS Firewalls

PHP released a broad security patch addressing memory-allocation failure handling, while Gurucul researchers reported exploitation of two critical PHP memory-safety vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell, that can enable remote code execution. SC Media described an allocation-related flaw known for roughly two years whose uncertain exploitability initially reduced its urgency, before researchers developed exploits with assistance from LLM agents. The patch changed 423 files, adding extensive tests and replacing allocation functions with alternatives that account for failures. An early embargo break increased pressure on administrators before fixes became available.

Gurucul identified 616 associated files, including exploit kits, scanners, custom tools, and post-exploitation utilities. The researchers reported that attackers adapted the exploit chain to internet-facing PAN-OS firewalls and obtained root access, with targeting spanning government agencies, banks, telecommunications providers, and universities. Reliable mass exploitation remains unconfirmed, and SC Media cautioned that some agent-assisted proof-of-concept releases lacked convincing evidence. Defenders should prioritize applicable PHP security updates, assess potentially exposed firewall deployments against vendor guidance, and investigate suspicious shell activity and signs of post-exploitation.